feat(golf): add JWT authentication and session reconnection#1119
Merged
feat(golf): add JWT authentication and session reconnection#1119
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
1d4-web | 7011244 | Commit Preview URL Branch Preview URL |
Mar 08 2026, 08:40 PM |
3 tasks
Decouple player identity from WebSocket connections so players can reconnect after brief disconnections (e.g. switching apps on mobile to share a link) and resume their room/game with the same player ID. - Add manual JWT (HS256) token manager using stdlib crypto (no deps) - Require authenticate message as first action after connecting - Track disconnected sessions with 5-minute grace period - Swap client references on reconnect without removing from game - Add auth, reconnect, and algorithm validation tests
aaylward
force-pushed
the
feat/golf-jwt-reconnect
branch
from
44af9de to
aeb2802
Compare
Update all three READMEs to accurately document the hub interface, JWT auth/reconnect flow, message protocol, and code layout. Remove speculative roadmap checklists that belonged in issues, not docs.
This was referenced Mar 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
crypto/hmac+crypto/sha256— no external dependenciesalgheader field to prevent algorithm confusion attacksDetails
auth.go:TokenManagerfor creating/validating JWTs with 24h TTLgolf_hub.go: Rewritten to require authentication before any game action; tracks disconnected sessions; handles reconnection by swapping client referencesgame.go: AddedReplaceClientfor updating player's client ID on reconnecttypes.go: AddedPlayerSession,AuthenticatedMessagetypesTest plan
TestHub_AuthenticationRequired— unauthenticated messages rejectedTestHub_AuthenticationFlow— new session creation worksTestHub_TokenReconnection— full reconnect flow with tokenTestHub_AlgValidation— tampered tokens and wrong algorithms rejectedbazel test //domains/games/apis/games_ws_backend/golf:golf_testpasses